In the boardroom, we discuss the use of AI, advanced data classification, and abstract compliance rules. However, as long as the foundation is shaky, effective data security remains an illusion. True data security goes beyond the application level and reaches the deepest physical layers of our IT infrastructure. How do you build a foundation that withstands strict legislation and stands up to tomorrow’s storms?
In this second part of our roundtable discussion on data security, featuring experts from Dell Technologies, Fox-IT, Klarrio, Everpure, Thales, and Veeam, we dive a bit deeper into the technical aspects. What quickly becomes clear is that there is no one-size-fits-all approach to securing corporate data. There’s no magic tool or silver bullet. Protecting your crown jewels requires a holistic view of the entire chain. That starts with the most tangible foundation: the hardware and an understanding of your own systems.
Visibility as a duty
In the security world, there’s a lot of talk about building a robust data strategy, but the harsh reality is that many organizations have gaps in their visibility. A persistent design flaw that is often made is completely separating data security from the physical infrastructure. Floris Dankaart (Fox-IT) warns against this, referring to the CIA Triad security model, which consists of three pillars for protecting systems and data. The pillars are confidentiality, integrity, and availability. These elements stand or fall with the foundation. “You cannot view data security in isolation from the underlying infrastructure and hardware, because these determine how effectively you can secure your data,” says Dankaart.
Beyond this technical necessity, increasing regulatory pressure from Europe is eliminating the last remnants of discretion. With the recent implementation of local legislation stemming from the NIS2 Directive, organizations in critical sectors are being held accountable for their oversight. Dankaart leaves no room for misunderstanding: “The message that rings loud and clear between the lines of that legislation is that you must know exactly what data you have and where it is located within the network. Without that knowledge, you simply can’t get away with it anymore.” Whether organizations gain that insight through active network monitoring, passive scanning in operational environments, or via sensors in a Security Operations Center (SOC), it is the non-negotiable foundation before further mitigation can begin.
Fragmentation is undesirable; a central source is better
Yet that actual overview is often missing. Marco Bal (Everpure) sees this as partly due to the data fragmentation that has emerged over the past decade. Business data, whether structured or unstructured, is duplicated across countless on-premises servers and isolated SaaS applications. Which is the correct version? Which is the correct copy? And how do you protect all that data? “To regain control, we need to move toward a single, robust source of truth for the data,” argues Bal. From that single, secure, centralized source, applications, AI agents, or users can safely and securely access their information.
Incidentally, this shift also places high demands on the storage itself. Bal emphasizes that the underlying hardware platform must be able to evolve seamlessly with new data requirements. “This must happen without reaching the point where your production environment grinds to a halt because you can’t move forward,” Bal explains. An outdated storage platform that can’t keep up with modern security and data requirements quickly becomes a millstone around your neck.
Secure hardware
Because organizations rely heavily on external suppliers for their security, supply chain security, according to Dick Vonk (Dell Technologies), starts with the production of hardware. Security measures are built in at that stage. “During the production of, say, a backup device, we already embed special security code in the factory and perform physical checks. As soon as such a device is powered up in the customer’s rack, it independently verifies whether it still contains the original components and whether anything in the memory or network cards might have been tampered with unnoticed somewhere along the supply chain.”
This is how Dell Technologies uses Secured Component Verification to verify that the delivered hardware matches the original specifications. It also checks for signs the hardware may have been tampered with during production or transport. In this way, the focus is not only on the security of the hardware once it is in use, but also on its integrity before it arrives at an organization.
Harvest now, decrypt later
The introduction of Post-Quantum Cryptography (PQC) makes it clear that IT must evolve faster and more fundamentally than weare used to. For years, this was mostly a theoretical topic among academics, but the threat is rapidly becoming a harsh business reality. Yet everyday practice often proves more challenging. Edwin Weijdema (Veeam) highlights concerns about the “harvest now, decrypt later” principle. Under this approach, cybercriminals are currently collecting bulk encrypted data that is still unreadable to them, with the aim of decrypting it using quantum techniques in the future. While securing environments, Weijdema encounters extremely basic operational barriers that hinder upgrades.
“I come across environments in hospitals that are sometimes still running on Windows NT 4.0,” says Weijdema, referring to the 1996 operating system. “The problem is that the operating system is directly linked to specialized medical equipment. As soon as you make even the slightest change to the machine, it’s no longer certified. And with that, the research is no longer certified either.” This involves MRI scanners, X-ray equipment, and laboratory instruments. To navigate these dilemmas without leaving the organization irresponsibly vulnerable, Weijdema recommends a pragmatic approach based on the “minimum viable business.” “Sit down with the operational departments and pinpoint exactly which specific business processes and datasets you truly need, as an absolute minimum, if everything comes to a standstill or you lose everything. Everything else is secondary. You’ll then know which core areas to focus on first; you don’t have to do everything at once.”
From paralysis to sovereignty
The knowledge that encryption will eventually become crackable, combined with the complex legislation currently being rolled out, is causing panic to take hold in many boardrooms. Werner Vermeylen (Klarrio) observes a degree of “analysis paralysis” in many organizations when the security issue comes up. “What we’re seeing is that, out of blind panic, companies want to map out their cryptographic library from A to Z and solve everything at once. The result is that they get completely bogged down by the complexity even in the exploratory and preparatory phase.” To keep momentum going, Vermeylen strongly advises companies to start pragmatically with their most valuable data assets and build out in phases from there.
He also warns that the necessary holistic scope is substantially broader than just encryption. It’s also about sovereignty, a term often limited to the physical national borders where a server is located, but according to Vermeylen, it revolves just as much around actual architectural control. He illustrates this risk with a real-world example of a company that had an application built by an external consultant. “They ultimately lost complete control over their own, self-generated, business-critical data because it was locked into an unknown and proprietary data format belonging to that service provider, who then began charging licensing fees for it. They viewed it as their own product.” According to him, sovereignty is therefore a critical security issue. “It really is purely about control. Who owns what? When you build or purchase certain solutions, who is ultimately the actual owner of the data and the artifacts that result from it?”
No more excuses: back to basics
Despite the wide range of perspectives, from legacy medical systems to advanced quantum threats and vendor lock-ins, the discussion concludes with a clear consensus. Successfully navigating these technological shifts requires the same fundamental cyber hygiene, without exception. Ilkay Kahraman (Thales) therefore issues a clear, motivating call to action to CISOs and decision-makers. “How should you get started? Put your data first. It becomes much easier to manage things effectively from a central location and set priorities when you know where your data, secrets, and keys are located. Then you can take action more easily, including in relation to AI and PQC.” Kahraman notes that there is also plenty of supporting research. “For example, the Dutch AIVD, SWI, and TNO have developed a PQC migration guide that organizations can use to take their first steps.”
On the technology side, the necessary resources are becoming increasingly available. The new generation of Hardware Security Modules (HSMs) is designed from the ground up for PQC. Native PQC support and a cryptographic processor developed by Thales provide the necessary computing power and performance. With the available guidelines and reports from renowned institutions, Kahraman believes there is no reason to wait any longer. His concluding key message to the market is therefore simple and urgent: take the first step, better today than tomorrow.
This was our final article in a two-part series on data security. Be sure to read the first article as well, which highlights how AI is prompting organizations to rethink data security.